#!/usr/bin/env bash
# =============================================================================
# eBdesk SiCABE — StarRocks: terapkan DYNAMIC CONFIG (hilang saat FE restart)
# =============================================================================
# Mengapa terpisah dan BUKAN di fe.conf?
#   `authentication_chain` harus memuat `sr_oidc`, tetapi integrasi `sr_oidc`
#   baru dibuat lewat SQL (bootstrap step 5). Pada boot pertama FE, integrasi itu
#   BELUM ada sehingga menaruhnya di fe.conf akan gagal. Nilainya karena itu
#   bersifat runtime: harus diterapkan ULANG setiap kali FE restart.
#
# Yang diterapkan:
#   1. authentication_chain = native,<sr_oidc>   → tanpa ini login OIDC mati
#      (integrasi tetap "ada" di SHOW SECURITY INTEGRATIONS, jadi sulit terlihat).
#   2. activate_all_roles_on_login = TRUE        → role otomatis aktif saat login.
#
# Skrip ini:
#   - idempoten (aman dipanggil berkali-kali),
#   - memverifikasi lebih dulu bahwa security integration ada (kalau tidak,
#     berhenti dengan pesan agar menjalankan bootstrap step 5),
#   - memverifikasi hasilnya setelah diterapkan (exit != 0 bila gagal).
#
# Usage:
#   ./scripts/starrocks-reapply-dynamic-config.sh
#   # StarRocks existing:
#   STARROCKS_HOST=starrocks.corp STARROCKS_PORT=9030 \
#     STARROCKS_ROOT_PASSWORD=... ./scripts/starrocks-reapply-dynamic-config.sh
# =============================================================================
set -uo pipefail

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
# shellcheck source=../lib/common.sh
source "${SCRIPT_DIR}/lib/common.sh"
# shellcheck source=../config/environment.defaults.sh
source "${SCRIPT_DIR}/config/environment.defaults.sh"
sicabe_load_env "${SCRIPT_DIR}" "$@"

STARROCKS_HOST="${STARROCKS_HOST:-localhost}"
STARROCKS_PORT="${STARROCKS_PORT:-${STARROCKS_FE_PORT:-12930}}"
# Multi-host: arahkan ke host pemilik StarRocks FE (single-host tetap localhost).
STARROCKS_HOST="$(sicabe_local_host STARROCKS_FE_HOST STARROCKS_HOST)"
SR_USER="${STARROCKS_USER:-root}"
SR_PW="${STARROCKS_ROOT_PASSWORD:-}"
OIDC_NAME="${STARROCKS_OIDC_INTEGRATION:-sr_oidc}"
SR_MYSQL_IMAGE="${SR_MYSQL_IMAGE:-mysql:8}"

if command -v mysql >/dev/null 2>&1; then
  SR_MODE="host"
elif docker image inspect "${SR_MYSQL_IMAGE}" >/dev/null 2>&1; then
  SR_MODE="container"
else
  SR_MODE="none"
fi

# sr_sql <sql> → hasil; kode keluar bukan-0 bila koneksi/kliens gagal.
sr_sql() {
  case "${SR_MODE}" in
    host)
      MYSQL_PWD="${SR_PW}" mysql --protocol=TCP -h "${STARROCKS_HOST}" -P "${STARROCKS_PORT}" \
        -u "${SR_USER}" -N -B -e "$1" 2>/dev/null
      ;;
    container)
      docker run --rm -i --network "${SICABE_NETWORK:-sicabe-network}" \
        -e MYSQL_PWD="${SR_PW}" "${SR_MYSQL_IMAGE}" \
        mysql --protocol=TCP -h "${STARROCKS_HOST}" -P "${STARROCKS_PORT}" -u "${SR_USER}" \
        -N -B -e "$1" 2>/dev/null
      ;;
    *) return 1 ;;
  esac
}

apply_dynamic_config() {
  echo -e "${INFO} [1/2] authentication_chain = native,${OIDC_NAME}"
  sr_sql "ADMIN SET FRONTEND CONFIG (\"authentication_chain\" = \"native,${OIDC_NAME}\");" >/dev/null

  echo -e "${INFO} [2/2] activate_all_roles_on_login = TRUE"
  sr_sql "SET GLOBAL activate_all_roles_on_login = TRUE;" >/dev/null
}

main() {
  print_section "StarRocks — terapkan dynamic config (auth chain OIDC)"

  if [[ "${SR_MODE}" == "none" ]]; then
    echo -e "${ERR} Klien MySQL tidak tersedia di host dan image ${SR_MYSQL_IMAGE} belum ada."
    echo "  Install klien: sudo apt-get install -y mysql-client   (atau tarik image mysql)"
    exit 1
  fi
  if [[ -z "${SR_PW}" ]]; then
    echo -e "${ERR} STARROCKS_ROOT_PASSWORD kosong (isi di .env)."
    exit 1
  fi
  if [[ "$(sr_sql 'SELECT 1')" != "1" ]]; then
    echo -e "${ERR} Tidak bisa terhubung ke StarRocks di ${STARROCKS_HOST}:${STARROCKS_PORT}."
    exit 1
  fi
  echo -e "${OK} Terhubung ke ${STARROCKS_HOST}:${STARROCKS_PORT}"

  # Prasyarat: integrasi harus sudah ada — kalau tidak, menyetel chain akan error.
  if ! sr_sql "SHOW SECURITY INTEGRATIONS;" | grep -q "${OIDC_NAME}"; then
    echo -e "${ERR} Security integration '${OIDC_NAME}' belum ada."
    echo "  Jalankan dulu: ./bootstrap.sh --step 5"
    exit 1
  fi
  echo -e "${OK} Security integration '${OIDC_NAME}' ada (prasyarat terpenuhi)"

  apply_dynamic_config

  # Verifikasi hasil — jangan lapor sukses tanpa bukti.
  local chain roles
  chain="$(sr_sql "ADMIN SHOW FRONTEND CONFIG LIKE 'authentication_chain';" | awk -F'\t' '{print $3}')"
  roles="$(sr_sql "SHOW VARIABLES LIKE 'activate_all_roles_on_login';" | awk -F'\t' '{print $2}')"

  local rc=0
  if [[ "${chain}" == *"${OIDC_NAME}"* ]]; then
    echo -e "${OK} authentication_chain = ${chain}"
  else
    echo -e "${ERR} authentication_chain = ${chain:-tak terbaca} — gagal memuat ${OIDC_NAME}"
    rc=1
  fi
  if [[ "${roles}" == "true" ]]; then
    echo -e "${OK} activate_all_roles_on_login = ${roles}"
  else
    echo -e "${ERR} activate_all_roles_on_login = ${roles:-tak terbaca} (diharapkan true)"
    rc=1
  fi

  if [[ ${rc} -eq 0 ]]; then
    echo -e "${OK} ${GREEN}Dynamic config diterapkan.${NC}"
    echo -e "${INFO} Verifikasi menyeluruh: ./scripts/verify-phase4-serving.sh"
  else
    echo -e "${ERR} Sebagian dynamic config gagal diterapkan."
  fi
  exit ${rc}
}

main "$@"